[Declude.JunkMail] RE: Various Greeting Card messages

2007-07-12 Thread Kornitz, David
Has anyone found (or come up with) an effect filter for all of the
greeting card messages floating around.  I have been playing with them,
but in doing so, I end up blocking legitimate cards.   Any suggestions
would be greatly appreciated.

Davud


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



RE: [Declude.JunkMail] Valid Senders - Best Declude Practices

2006-12-30 Thread Kornitz, David
About a year ago, I wrote a C++ (no external dependencies) external-plus
(whitelist/blacklist) add-in for Declude that supports the following:

1.  Whitelist / Blacklist at company level.
2.  Whitelist / Blacklist at user level (has support for aliases via
redirection)
3.  Whitelist / Blacklist at a group level (supported by
redirection)
4.  Includes validating recipients (If there is one valid recipient,
then the message is allowed)

The program supports filtering the to, from and subject fields, as well
as, IP addresses in the headers.

For the to, from and subject fields, the software supports matching
using StartsWith, EndsWith, Contains, is (equal), NotStartsWith,
NotEndsWith, NotContains, IsNot and Regex

For IP addresses, it supports the following formats: single address
(192.168.1.3) and multiple addresses  (192.168.1.3\255.255.255.255
[single address], 192.168.1.3\32 [single address],
192.168.1\255.255.255.0 [single class "C"] or 192.168.1.5\24 [single
class "C"] or 192.168.1.5\255.255.255.254 [two class "C" ranges] or
192.168.1.5\25 [two class "C" ranges] and so on.

It also has a valid recipient list for the domain and has full logging
capabilities.

Like others we are also preprocessing our email and we are using
"xWall".  Using xWall, it blocks in over 90% of our incoming email.

If any one is interested in the software, please let me know and I would
be glad to share it.

David 
Cornerstone Computer Solutions, Inc.

-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of
Michael Cummins
Sent: Saturday, December 30, 2006 2:35 PM
To: declude.junkmail@declude.com
Subject: RE: [Declude.JunkMail] Valid Senders - Best Declude Practices

> 5XXSink  is  a  connection-time  event  sink  for  MS SMTP

This sounds like an interesting tool.  What if I can only apply it to
some domains though?  If I set this up on the same box as SmarterMail,
and used the MS SMTP to forward to SmarterMail (what, on a different
port I guess?) then am I correct in guessing that I have to have a
comprehensive list of all recipients?  I don't think I'll be able to get
all the Exchange Servers I service to play nice right away.

> OTOH, if you  were  using  IMail  as  the  MTA wrapper for Declude, it

> would be possible  to do all this stuff natively within IMail by using

> a "smart store-and-forward"  setup  and some sync scripts for your S&F

> domains.
> 
> The same logic seems possible for SM, and would certainly be the "best

> way"  in  theory;  but if you've already probed their forums, I assume

> there's no established "cookbook" from that side.

I'm pretty sure that Declude processes the traffic before the IMail
product, so I need to nab it before it gets to Declude if I'm going to
trim my resources.  I'm not sure about SmarterMail, but I suspect the
same.  MSG gets handed to Declude, which calls up Sniffer and invURIBL,
and then tosses it back into the MTA queue for mail handling.

Unless I'm wrong, in which case I'll get tapped back in line.  :)  

In iMail you set up Store and Forward by entering the IP in the SMTP
security, and then making an entry in the Windows Host file.  In
SmarterMail you just enter the IP/domain name in "Domain Forwarding" -
no place to really put any e-mail addresses for either product, that I
know of anyway.
:(

You know, Declude Pro handles a whitelist.txt and a blacklist.txt on a
per domain config.  It might be nice to have a validRecipients.txt file
too.
Yeah, it's sort of useless for POP/IMAP domains but it would sure be
handy for store and forward relay.  It would really cut down on my
resource load if that could be one of the first tests processed, so all
the other little engines don't have to waste their time.

> --Sandy

Thanks for your input, Sandy!  You too, Markus, Mark and Herb. Alligate
looks like an impressive gateway product, I'll keep it in mind - and I'm
thinking of upgrading the hardware on that box now as well.  It wasn't
all that shabby to begin with though.  

-- Michael Cummins



Sanford Whiteman, Chief Technologist
Broadleaf Systems, a division of
Cypress Integrated Systems, Inc.
e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!
 
http://www.imprimia.com/products/software/freeutils/SPAMC32/download/rel
ease
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!
 
http://www.imprimia.com/products/software/freeutils/exchange2aliases/dow
nloa
d/release/
 
http://www.imprimia.com/products/software/freeutils/ldap2aliases/downloa
d/re
lease/



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.




---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be foun

RE: [Declude.JunkMail] Where do I enter my serial number

2006-07-02 Thread Kornitz, David
Gary,

The code gets placed in the "Declude.cfg" The format is:

CODEX----

David
-Original Message-
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary
Steiner
Sent: Sunday, July 02, 2006 1:20 PM
To: declude.junkmail@declude.com
Subject: re: [Declude.JunkMail] Where do I enter my serial number

I believe Declude Support has to do it manually on their end.  However,
they are closed on the weekend, so you are not going to get any response
from them til Monday (unless they are taking off Monday in conjunction
with the 4th of July, in which case you may have to wait until
Wednesday).  Regardless, you should send a message to Declude Support
([EMAIL PROTECTED]) with your serial number and hopefully you will
hear back from them sooner than later.

Gary


 Original Message 
> From: "Joe Raykiewicz" <[EMAIL PROTECTED]>
> Sent: Sunday, July 02, 2006 11:23 AM
> To: declude.junkmail@declude.com
> Subject: [Declude.JunkMail] Where do I enter my serial number
> 
> I purchased the Declude 4.2 security suite.  I have smartermail 3.3 
> enterprise.  Where do I enter my serial number?
> 
> Thanks,
> 
> Joe
> 
> 
> 
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.





---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.



---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.



RE: Re[2]: [Declude.JunkMail] ANN: Availability of 5xxSink 0.5.00, IIS SMTP event sink for text-file recipient validation

2005-12-04 Thread Kornitz, David
You may want to take a look at Xwall by DataEnter
(http://www.dataenter.co.at/products/xwall.htm) It supports user
validation with a text file of via LDAP, greylisting, RBL / SBS/ SURBL,
Bayes, SPF, CCS, Sender ID to name a few.  We purchased the product for
greylisting and it reduced our mail volume by 80%.  The product claims
that it is for exchange, but works fine with SMTP Service included with
Windows.

FYI:We host very few email accounts, we are prodominately providing
a service that office spam and virus filtering.

David 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of Markus Gufler
Sent: Sunday, December 04, 2005 9:36 AM
To: Declude.JunkMail@declude.com
Subject: RE: Re[2]: [Declude.JunkMail] ANN: Availability of 5xxSink
0.5.00, IIS SMTP event sink for text-file recipient validation

This seems a great thing. It should also allow me to run gatewaying
services to a restricted number of recipients, or in other words: offer
relaying packages for 10, 20, 30, ... users.

How much users are realistic vor 5xxSink?

Markus

---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude EVA www.declude.com]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] SPFPass - good or bad?

2005-09-08 Thread Kornitz, David
I use SPFFail to add weight to test to a message, but like you I have
also seen spammers creating SPF records, which in turn allows them to
get lower score with SPFPass.  As a result, we no long find that SPFPass
is a useful in detecting spam.   

David Kornitz / Cornerstone Computer Solutions, Inc,
-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of David Dodell
Sent: Thursday, September 08, 2005 12:28 AM
To: declude.junkmail@declude.com
Subject: [Declude.JunkMail] SPFPass - good or bad?

I've noticed a bunch of spam with SPFPass grades that have negated the
spam databases (I have SPFPass at -5) ... is anyone finding that
SPFPass is working with spammers using legitimate ISP's?

david

-
Internet Dental Forum  www.internetdentalforum.org
Dentalcast Podcast www.dentalcast.net

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Declude Application Errors

2005-02-02 Thread Kornitz, David



I have found a couple of them and have forwarded them to 
support.
 
Thanks


From: [EMAIL PROTECTED] 
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff 
(Lists)Sent: Wednesday, February 02, 2005 9:19 PMTo: 
Declude.JunkMail@declude.comSubject: RE: [Declude.JunkMail] Declude 
Application Errors


Check to see if there 
are any declude.gpx where x is a number and if so send a message to support 
letting them know of that.
 

John 
Tolmachoff
Engineer/Consultant/Owner
eServices For 
You
 

-Original 
Message-From: 
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] 
On Behalf Of Kornitz, 
DavidSent: Wednesday, 
February 02, 2005 6:27 
PMTo: 
Declude.JunkMail@declude.comSubject: [Declude.JunkMail] Declude 
Application Errors
 

Is anyone else seeing an error like 
this in there system log?

 

Event 
Type: InformationEvent Source: Application ErrorEvent 
Category: (100)Event 
ID: 1004Date:  2/2/2005Time:  7:50:32 
AMUser:  N/AComputer: NS2Description:Reporting 
queued error: faulting application Declude.exe, version 0.0.0.0, faulting module 
Declude.exe, version 0.0.0.0, fault address 0x0002be9e.

 

For more information, see Help and 
Support 
Center at http://go.microsoft.com/fwlink/events.asp.Data:: 
41 70 70 6c 69 63 61 74   Applicat0008: 69 6f 6e 20 46 61 69 
6c   ion Fail0010: 75 72 65 20 20 44 65 63   ure  
Dec0018: 6c 75 64 65 2e 65 78 65   lude.exe0020: 20 30 2e 30 
2e 30 2e 30    0.0.0.00028: 20 69 6e 20 44 65 63 
6c    in Decl0030: 75 64 65 2e 65 78 65 20   
ude.exe 0038: 30 2e 30 2e 30 2e 30 20   0.0.0.0 0040: 61 74 20 
6f 66 66 73 65   at offse0048: 74 20 30 30 30 32 62 65   
t 0002be0050: 39 
65 
9e  

 

The error is occuring about 20 times 
a day (messages of course are not processed) on a volume of 
35,000/day.

 

Declude 
2.0


[Declude.JunkMail] Declude Application Errors

2005-02-02 Thread Kornitz, David



Is anyone else 
seeing an error like this in there system log?
 
Event 
Type: InformationEvent Source: Application ErrorEvent 
Category: (100)Event 
ID: 1004Date:  2/2/2005Time:  7:50:32 
AMUser:  N/AComputer: NS2Description:Reporting 
queued error: faulting application Declude.exe, version 0.0.0.0, faulting module 
Declude.exe, version 0.0.0.0, fault address 0x0002be9e.
 
For more 
information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.Data:: 
41 70 70 6c 69 63 61 74   Applicat0008: 69 6f 6e 20 46 61 69 
6c   ion Fail0010: 75 72 65 20 20 44 65 63   ure  
Dec0018: 6c 75 64 65 2e 65 78 65   lude.exe0020: 20 30 2e 30 
2e 30 2e 30    0.0.0.00028: 20 69 6e 20 44 65 63 
6c    in Decl0030: 75 64 65 2e 65 78 65 20   
ude.exe 0038: 30 2e 30 2e 30 2e 30 20   0.0.0.0 0040: 61 74 20 
6f 66 66 73 65   at offse0048: 74 20 30 30 30 32 62 65   
t 0002be0050: 39 
65 
9e  
 
The error is 
occuring about 20 times a day (messages of course are not processed) on a volume 
of 35,000/day.
 
Declude 
2.0


RE: [Declude.JunkMail] Problem with subject line in version 2.0

2005-02-01 Thread Kornitz, David
In my case, I had downloaded the "Full" version last nightI agree
that the version numbers should be changing or it will become more
difficult to resolve problems for all of us. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Tuesday, February 01, 2005 8:30 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Problem with subject line in version 2.0

That is another problem in the growing list:

How do you know what version you have?

Both of them showed version 2.0. Wasn't the beta 2.0b? if so, then that
means the released version predates the beta version.

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> [EMAIL PROTECTED] On Behalf Of Kornitz, David
> Sent: Tuesday, February 01, 2005 6:21 PM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] Problem with subject line in version 
> 2.0
> 
> I ave the same problem and have reverted to the previous 2.0 version.
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of John 
> Tolmachoff
> (Lists)
> Sent: Tuesday, February 01, 2005 7:58 PM
> To: Declude.JunkMail@declude.com
> Cc: [EMAIL PROTECTED]
> Subject: RE: [Declude.JunkMail] Problem with subject line in version 
> 2.0
> Importance: High
> 
> The latest version does not work at all, nothing, zilch, zippo.
> 
> This is a disgrace.
> 
> Downloaded and copied into the imail directory and ran "declude -diag"
> and all I got was the declude version line and then a line saying 
> Imail configuration then several seconds and then back to a prompt.
> 
> No output what so ever.
> 
> Nothing in the logs at all.
> 
> FIX THIS NOW!
> 
> John Tolmachoff
> Engineer/Consultant/Owner
> eServices For You
> 
> 
> > -Original Message-
> > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> > [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
> > Sent: Tuesday, February 01, 2005 10:21 AM
> > To: Declude.JunkMail@declude.com
> > Subject: RE: [Declude.JunkMail] Problem with subject line in version

> > 2.0
> >
> > The fix is in the current 2.0 download from the web site.
> >
> > Barry Simpson
> > www.declude.com
> >
> >
> > -Original Message-
> > From: [EMAIL PROTECTED]
> > [mailto:[EMAIL PROTECTED] On Behalf Of John 
> > Tolmachoff
> > (Lists)
> > Sent: Tuesday, February 01, 2005 11:33 AM
> > To: Declude.JunkMail@declude.com
> > Subject: RE: [Declude.JunkMail] Problem with subject line in version

> > 2.0
> >
> > And the fix will be when and in what form?
> >
> > John Tolmachoff
> > Engineer/Consultant/Owner
> > eServices For You
> >
> > > -Original Message-
> > > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-

> > > [EMAIL PROTECTED] On Behalf Of R. Scott Perry
> > > Sent: Tuesday, February 01, 2005 4:31 AM
> > > To: Declude.JunkMail@declude.com
> > > Subject: Re: [Declude.JunkMail] Problem with subject line in 
> > > version
> 
> > > 2.0
> > >
> > >
> > > >There appears to be a problem in version 2.0 where Declude is 
> > > >seeing
> the
> > > >first character after the word subject as the start of the 
> > > >subject
> line.
> > The
> > > >first character is a colon and followed by a space and then the 
> > > >actual subject line.
> > >
> > > You are correct.  I'm surprised this didn't get caught during the
> beta.
> > >
> > > -Scott
> > > ---
> > > Declude JunkMail: The advanced anti-spam solution for IMail 
> > > mailservers since 2000.
> > > Declude Virus: Ultra reliable virus detection and the leader in
> mailserver
> > > vulnerability detection.
> > > Find out what you've been missing: Ask for a free 30-day
evaluation.
> > >
> > > ---
> > > [This E-mail was scanned for viruses by Declude Virus
> > (http://www.declude.com)]
> > >
> > > ---
> > > This E-mail came from the Declude.JunkMail mailing list.  To 
> > > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type

> > > "unsubscribe Declude.JunkMail".  The archives can be found at 
> > > http://www.mail-archive.com.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus 
> > (http://www.declude

RE: [Declude.JunkMail] Problem with subject line in version 2.0

2005-02-01 Thread Kornitz, David
I ave the same problem and have reverted to the previous 2.0 version. 

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of John Tolmachoff
(Lists)
Sent: Tuesday, February 01, 2005 7:58 PM
To: Declude.JunkMail@declude.com
Cc: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Problem with subject line in version 2.0
Importance: High

The latest version does not work at all, nothing, zilch, zippo.

This is a disgrace.

Downloaded and copied into the imail directory and ran "declude -diag"
and all I got was the declude version line and then a line saying Imail
configuration then several seconds and then back to a prompt.

No output what so ever.

Nothing in the logs at all.

FIX THIS NOW!

John Tolmachoff
Engineer/Consultant/Owner
eServices For You


> -Original Message-
> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> [EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
> Sent: Tuesday, February 01, 2005 10:21 AM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] Problem with subject line in version 
> 2.0
> 
> The fix is in the current 2.0 download from the web site.
> 
> Barry Simpson
> www.declude.com
> 
> 
> -Original Message-
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of John 
> Tolmachoff
> (Lists)
> Sent: Tuesday, February 01, 2005 11:33 AM
> To: Declude.JunkMail@declude.com
> Subject: RE: [Declude.JunkMail] Problem with subject line in version 
> 2.0
> 
> And the fix will be when and in what form?
> 
> John Tolmachoff
> Engineer/Consultant/Owner
> eServices For You
> 
> > -Original Message-
> > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- 
> > [EMAIL PROTECTED] On Behalf Of R. Scott Perry
> > Sent: Tuesday, February 01, 2005 4:31 AM
> > To: Declude.JunkMail@declude.com
> > Subject: Re: [Declude.JunkMail] Problem with subject line in version

> > 2.0
> >
> >
> > >There appears to be a problem in version 2.0 where Declude is 
> > >seeing
the
> > >first character after the word subject as the start of the subject
line.
> The
> > >first character is a colon and followed by a space and then the 
> > >actual subject line.
> >
> > You are correct.  I'm surprised this didn't get caught during the
beta.
> >
> > -Scott
> > ---
> > Declude JunkMail: The advanced anti-spam solution for IMail 
> > mailservers since 2000.
> > Declude Virus: Ultra reliable virus detection and the leader in
mailserver
> > vulnerability detection.
> > Find out what you've been missing: Ask for a free 30-day evaluation.
> >
> > ---
> > [This E-mail was scanned for viruses by Declude Virus
> (http://www.declude.com)]
> >
> > ---
> > This E-mail came from the Declude.JunkMail mailing list.  To 
> > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> > "unsubscribe Declude.JunkMail".  The archives can be found at 
> > http://www.mail-archive.com.
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus 
> (http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.
> 
> 
> 
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
> 
> ---
> This E-mail came from the Declude.JunkMail mailing list.  To 
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type 
> "unsubscribe Declude.JunkMail".  The archives can be found at 
> http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type
"unsubscribe Declude.JunkMail".  The archives can be found at
http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Log Levels

2005-02-01 Thread Kornitz, David



I working a routing 
to process the log files for declude.  The ultimate goal is to produce 
statitics and graphs based on the information from the log files.  I 
checked the manual and the descripiton for the various log formats is 
vague.  
 
WARN (This is in the 
current global.cfg, but I see no reference to anywhere else)
LOW
MID
HIGH
DEBUG (Used for 
debugging potential problems with Declude)
ERROR: Logs error 
only.
 
Is there someplace 
that lists what specifically is in each of the levels?  or does someone 
know what is in each of the levels?
 
Thanks in 
advance.


[Declude.JunkMail] Off Topic: Contracts for spam/virus filtering

2004-12-28 Thread Kornitz, David
We are in the process of creating a contract for spam/virus filtering service 
that we offer to our customers.  Does anyone have an example of such a contract 
that they would be willing to share?
 
Thanks in advance.
 
David
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] 100 Point scale / DNS

2004-09-28 Thread Kornitz, David








First Question:

 

I know this issue has been discussed in the past, but I
would like to make sure I understand the discussions:

 

1.  
We are contemplating revising the
scoring to a 100 point scale

2.  
I assume that when the conversion is
made that initially you select the value for 100 point and then proportionally
adjust the scores up.

 

Questions:  What weight did you use for the 100 points? Was it
the delete weight? Or the hold weight?  or something in between the values?

 

 

 

Second Question:

 

    I am receiving a lot of DNS timeout values, yet
when I go the run the IP address through NSLookup, it returns the address
immediately.  The primary address on the server is a Windows 2003 DNS server,
secondary addresses are linux DNS servers.   What DNS servers is Declude using
when doing a DNS lookup?  As I recall, there was a way to specify these values
in the global.cfg but I was not able to locate any information on this.   Anyone
have any recommendations or insight into the problem? 

 

Thanks for you help in advance,

 

David








[Declude.JunkMail] Virus Scanners Missing Viruses.

2004-06-18 Thread Kornitz, David
I have the following config for Virus Scanning:
 
#McAfee Command Line
SCANFILE1  Z:\IMail\NAI\SCAN.EXE /ALL /NOMEM /NOBEEP /NOBREAK /UNZIP /SILENT /NODDA 
/REPORT report.txt
VIRUSCODE1  13
REPORT1  Found
#CAI v7
SCANFILE2e:\Progra~1\CA\sHARED~1\ScanEn~1\inocmd32.exe -ARC -VER 
-LIS:report.txt -ENG VET
VIRUSCODE2 100
VIRUSCODE2 101
REPORT2  infected by virus:
#CAI v7
SCANFILE3   e:\Progra~1\CA\sHARED~1\ScanEn~1\inocmd32.exe -ARC -VER -LIS:report.txt
VIRUSCODE3 100
VIRUSCODE3 101
REPORT3  infected by virus:

For some reason, even though the definations are current and each of them reports that 
they are able to detect the virus, they are all missing "ZAFI.B" virus.  They are 
succufully catching the "Netsky" variants.
 
Anyone have any ideas?
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Error #183

2004-04-01 Thread Kornitz, David
Scott,

 

   I'd some checking and the error should have been occurring all the time, but 
for whatever reason it was not.  The problem was with the external plus test.  I was 
opening up the envelope header (the Q file) and extracting the sender and all 
recipients.  Apparently this was the problem.  I modified the test to open up the temp 
file and now everything works.

 

Thanks for your help!

 

David




From: [EMAIL PROTECTED] on behalf of R. Scott Perry
Sent: Wed 3/31/2004 4:36 PM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Error #183



What I would recommend in this case is searching the IMail SMTP log file
for references to the spool file name, minus the first character and
extension.  So with this line:

03/30/2004 22:04:49 Q435810aa00d01c07 WARNING: Could not unlock
Z:\IMail\spool\_435810aa00d01c07.~MD due to error #183.

you would search the IMail SMTP log file for "435810aa00d01c07".  If you
find that two incoming E-mails both use the same spool file name, it's an
IMail bug causing the problem.
   -Scott

At 05:30 PM 3/31/2004, Kornitz, David wrote:
> >Below is a log for a single email, the last line indicates that ther was
> >an error # 183.
>
>How often is this happening (just this once, occasionally, or for all
>E-mails)?
>
> the problem occurs in groups or batches
>
>Did it just start happening?
>
> Over the past month or so.
>
>If so, are you aware of any changes made recently?
>
> Updates are being made to "External Plus Test"
>
>What version of IMail are you running?
>
> 7.15 HF3
>
>What version of Declude are you running (you can type "\IMail\Declude
>-diag" from a command prompt to find
>out)?
>
> Declude 1.78 (C) Copyright 2000-2004 Computerized Horizons.
>
>
> Diagnostics ON (Declude v1.78).
>
>The Error #183 means that the file already exists, which means that when
>Declude JunkMail went to unlock the file (renaming it from _*.~MD to
>Q*.SMD), there was already a Q*.SMD file there).  Most likely, this is a
>bug in IMail causing a duplicate file to be used.  This would happen
>occasionally on IMail v7.04 and earlier, but I haven't seen it happen since
>(and I know you're on a version after 7.04, from the length of the spool
>file names).
>
> -Scott
>---
>Declude JunkMail: The advanced anti-spam solution for IMail mailservers
>since 2000.
>Declude Virus: Ultra reliable virus detection and the leader in mailserver
>vulnerability detection.
>Find out what you've been missing: Ask for a free 30-day evaluation.
>
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>---
>[This E-mail was scanned for viruses by Declude Virus
>(http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


<>

RE: [Declude.JunkMail] Error #183

2004-03-31 Thread Kornitz, David
>Below is a log for a single email, the last line indicates that ther was 
>an error # 183.

How often is this happening (just this once, occasionally, or for all 
E-mails)?  

the problem occurs in groups or batches

Did it just start happening?  

Over the past month or so.

If so, are you aware of any changes made recently?

Updates are being made to "External Plus Test"

What version of IMail are you running?

7.15 HF3

What version of Declude are you running (you can type "\IMail\Declude -diag" from a 
command prompt to find 
out)?

Declude 1.78 (C) Copyright 2000-2004 Computerized Horizons.


Diagnostics ON (Declude v1.78).

The Error #183 means that the file already exists, which means that when 
Declude JunkMail went to unlock the file (renaming it from _*.~MD to 
Q*.SMD), there was already a Q*.SMD file there).  Most likely, this is a 
bug in IMail causing a duplicate file to be used.  This would happen 
occasionally on IMail v7.04 and earlier, but I haven't seen it happen since 
(and I know you're on a version after 7.04, from the length of the spool 
file names).

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Error #183

2004-03-30 Thread Kornitz, David
Matt,

Thanks, but I had already reviewed that series of postsI should also 
mention that the C:\temp and c:\windows\temp are also exclude from Virus Scanning.

David

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Matt
Sent: Tuesday, March 30, 2004 10:42 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Error #183


Try the following, assuming that you are running McAfee as your scanner:

http://www.mail-archive.com/[EMAIL PROTECTED]/msg13155.html

There are also other mentions of error #183 in the archive that may be 
of use.

Matt


Kornitz, David wrote:

>Below is a log for a single email, the last line indicates that ther was an error # 
>183.   I have checked and these files are still sitting in the spool directory, Virus 
>scanning is excluding the following directories
>
>z:\IMAIL
>Z:\IMAIL\SPOOL
>Z:\IMAIL\SPOOL\VIRUS
>
>Any ideas as to other possible causes of this problem?
>
>Thanks in advance,
>
>
>David 
>
>
>
>
>03/30/2004 22:04:49 Q435810aa00d01c07 DSBL:5 SORBS-DUL:6 SORBS-HTTP:5 SORBS-MISC:5 
>SORBS-SOCKS:5 SPAMCOP:9 XBL:8 NOABUSE:2 NOPOSTMASTER:1 CMDSPACE:5 HELOBOGUS:6 .  
>Total weight = 57.
>03/30/2004 22:04:49 Q435810aa00d01c07 Subject: No Embarrassment!edith 
>03/30/2004 22:04:49 Q435810aa00d01c07 From: [EMAIL PROTECTED] To:  IP: 
>24.112.126.47 ID: 
>03/30/2004 22:04:49 Q435810aa00d01c07 Tests failed [weight=57]: TLD-TRUSTED-HELO=WARN 
>TLD-TRUSTED-MAILFROM=WARN TLD-TRUSTED-REVDNS=WARN DSBL=IGNORE SORBS-DUL=WARN 
>SORBS-HTTP=WARN SORBS-MISC=WARN SORBS-SOCKS=WARN SPAMCOP=WARN XBL=WARN NOABUSE=WARN 
>NOPOSTMASTER=WARN WEIGHT10=IGNORE WEIGHT15=IGNORE WEIGHT20=IGNORE WEIGHT24=IGNORE 
>WEIGHT30=IGNORE WEIGHT35=IGNORE WEIGHT40=IGNORE WEIGHT45=IGNORE WEIGHT50=IGNORE 
>WEIGHT55=IGNORE WEIGHTVHIGH=HOLD SPAM-VHIGH=SUBJECT CMDSPACE=WARN HELOBOGUS=WARN 
>IPNOTINMX=WARN NOLEGITCONTENT=WARN 
>03/30/2004 22:04:49 Q435810aa00d01c07 WARNING: Could not unlock 
>Z:\IMail\spool\_435810aa00d01c07.~MD due to error #183.
>---
>[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
>
>---
>This E-mail came from the Declude.JunkMail mailing list.  To
>unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>type "unsubscribe Declude.JunkMail".  The archives can be found
>at http://www.mail-archive.com.
>
>
>  
>

-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Error #183

2004-03-30 Thread Kornitz, David
Below is a log for a single email, the last line indicates that ther was an error # 
183.   I have checked and these files are still sitting in the spool directory, Virus 
scanning is excluding the following directories

z:\IMAIL
Z:\IMAIL\SPOOL
Z:\IMAIL\SPOOL\VIRUS

Any ideas as to other possible causes of this problem?

Thanks in advance,


David 




03/30/2004 22:04:49 Q435810aa00d01c07 DSBL:5 SORBS-DUL:6 SORBS-HTTP:5 SORBS-MISC:5 
SORBS-SOCKS:5 SPAMCOP:9 XBL:8 NOABUSE:2 NOPOSTMASTER:1 CMDSPACE:5 HELOBOGUS:6 .  Total 
weight = 57.
03/30/2004 22:04:49 Q435810aa00d01c07 Subject: No Embarrassment!edith 
03/30/2004 22:04:49 Q435810aa00d01c07 From: [EMAIL PROTECTED] To:  IP: 
24.112.126.47 ID: 
03/30/2004 22:04:49 Q435810aa00d01c07 Tests failed [weight=57]: TLD-TRUSTED-HELO=WARN 
TLD-TRUSTED-MAILFROM=WARN TLD-TRUSTED-REVDNS=WARN DSBL=IGNORE SORBS-DUL=WARN 
SORBS-HTTP=WARN SORBS-MISC=WARN SORBS-SOCKS=WARN SPAMCOP=WARN XBL=WARN NOABUSE=WARN 
NOPOSTMASTER=WARN WEIGHT10=IGNORE WEIGHT15=IGNORE WEIGHT20=IGNORE WEIGHT24=IGNORE 
WEIGHT30=IGNORE WEIGHT35=IGNORE WEIGHT40=IGNORE WEIGHT45=IGNORE WEIGHT50=IGNORE 
WEIGHT55=IGNORE WEIGHTVHIGH=HOLD SPAM-VHIGH=SUBJECT CMDSPACE=WARN HELOBOGUS=WARN 
IPNOTINMX=WARN NOLEGITCONTENT=WARN 
03/30/2004 22:04:49 Q435810aa00d01c07 WARNING: Could not unlock 
Z:\IMail\spool\_435810aa00d01c07.~MD due to error #183.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Declude Logs / Whitelisting

2004-03-30 Thread Kornitz, David
1. I've been reviewing the log files and what is the meaning of the following log 
entries:

03/30/2004 00:08:28 Q0ecf080d00fe32c8 L2 Message OK

03/30/2004 18:30:27 Q111b18cd00a62426 L1 Message OK


2. How can you disable  or adjust the score for disabling "Bypassing whitelisting"? 

Bypassing whitelisting of E-mail with weight >=35 (42) and at least 2 recipients (2).

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Spammers bypassing gateways?

2004-03-23 Thread Kornitz, David
Matt,

I've seen the same problem and the suggestion we have made to our customers is 
to reconfigure their firewall (or proxy server/smtp server), such that they only 
accept SMTP traffic from our mail servers.  This does not stop spam initially, but 
over a period of time, the traffic does slow down.   

It is my belief that some services are caching the MX (or A) records beyond 
the specified period.  I know at one of the sites I visit on a regular basis, that we 
made a change 3 months ago and we are still seeing attempts made to send mail directly 
to the mail server.

David  

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Matt
Sent: Tuesday, March 23, 2004 8:12 PM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Spammers bypassing gateways?


I've been wondering about the possibility and I think that I'm seeing 
proof of this now.  With gateway spam blocking services becoming more 
common, are spammers (zombie-types) now starting to attempt direct 
connections to mail.domain.tld instead of relying on MX records?

I've been advising new clients to avoid standard names such as mail and 
smtp for their mail servers due to the possibility of this happening.  
Twice now I have done switches though with servers named mail.domain.tld 
that continued to be spammed directly for weeks after the MX changed 
took place.  The only other possibility that I can think of is that some 
spamware is caching the IP's or MX records.

Has anyone else seen this?

Thanks,

Matt

-- 
=
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: Re[2]: [Declude.JunkMail] Per User Whitelisting Options

2004-03-09 Thread Kornitz, David

KD> I have written an external test that at the domain level allows
KD> the administrator decide whether the "domain" or "user" level 
KD> has priority when whitelisting or blacklisting.

What's your logic in that?

The idea is the following:

A specific company has certain organization that it deals with on a 
daily basis and therefore at the company (Domain) level there are 
certain defaults that should take place.   Some of the companies we
work with take the position that this is the way it is and allows no
deviations.  Other companies look at these lists a general guideline
and as such individual (or groups of) users should be allowed to 
override these defaults.  An example would be an architectural firm 
and information from the American Institute of Architects should be 
allowed in for all users (Whitelisted), but an engineering group 
within the firm may not want the same email and therefore the same
list may be blacklisted. 

The approach we took we the C++ routine was written was to add an 
option "COMPANY" that when enabled does not allow a user (or group)
setting to override the company settings.  And when the same option
is disabled, the preference goes to the user (or group).

...

We wrote C++ that parses every message from /spam and moves it to a use specific
folder, then give users access to folder through web GUI and
auto-delete after 10 days old.

BEWARE...NTFS doesn't like lots of
nodes in one root.  Right now we have about 3 million files and have
broken them down by drive:/Spam//Domain.ext//username/Q and
D files.  Sure there are better ways, but breaking down by A-Z was
easiest.  Holding spam with a file structure spam/domain/user took WAY
too long on disk access.  Also, you should format your drive with a
smaller cluster size than DEFAULT.  Remember 1/2 of all your files on
that drive will be less than 1k.  And...if you're using RAID
controller, disable Read-Ahead caching.



We've already run into this issue and are in the process of writing
a similar routine.  Our goal is to allow at the company level to
specify the number of days and if they want to hold more than the 
default number of days we are going to charge them additional fee.
The same idea applies to store and forward messages.


---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Per User Whitelisting Options

2004-03-09 Thread Kornitz, David
Here's the problems I have run into setting up an External Plus Test:

1.  Declude only uses tests the external plus test 1 time for each 
message.
   a.   Using %ALLRECIPS% can cause problems when there is a larger
  number of recipients.  Some of the parameters may not be passed
or may be are stripped off due to limitations of the length of a
command line.  (Not sure of the exact length)
   b.   A better solutions is to open and process the Imail envelope 
  header.  The file is in the same location as the Email and the 
first character of the file is changed to a "Q".  For example,
Da1a145c700a0da2c.SMD is the message and Qa1a145c700a0da2c.SMD
is the envelope header.  This file contains a list of recipients
specific to your server.  Scott mentioned that they are 
considering change how external plus test are being processed.

2.  You also have to consider what happens when there is a conflict.
You can be receiving a message for multiple domains (or even 
users within the same domain) and one user could whitelist the 
entry and another could blacklist it or have no preference.  

I have written an external test that at the domain level allows
the administrator decide whether the "domain" or "user" level 
has priority when whitelisting or blacklisting.

I still have the issue when multiple domains are being processed
in the same message.  I have checked and some of the larger 
companies that process for spam and viruses and each of them 
has a method for processing the message for individual recipients
something that Declude is missing.

3.  You also want to look at how matches are being processed.  (i.e.
is it an exact match, partial match, does it start with or end
with the string being compared.)

4.  The other request that has been made by a number of people is a 
way to move the messages marked as spam to a specific folder on
the server.  Scott mentioned that they were looking into this
but to the best of my knowledge there is no way to do this at the
present time.  

We are in the process of writing a front-end for Declude and at
this time we are probably going to write procedure to process all
of the "held" spam and move it to specific folders.  This will 
allow us to offer web based spam processing for our customers 
that have their own mail servers.


David Kornitz
Cornerstone Computer Solutions, Inc.

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of David Sullivan
Sent: Tuesday, March 09, 2004 11:30 AM
To: [EMAIL PROTECTED]
Subject: [Declude.JunkMail] Per User Whitelisting Options



I'm working on a white list solution to allow per user white listing
based on the sender/sending domain.  My setup is primarily as Store
and Forward for another server.  I have about 500 domains with about
20,000 users doing 300k msgs per day.

"Redirect"ing looks like a nice option but I'm a bit confused on it.
Basically, I would put the Redirect commands in .junkmail and point to a .cfg file.  
Then, I would modify
the actions (that are normally used for outgoing mail in global.cfg)in
that new .cfg file based on what I wanted to happen for the domain,
correct?  Could I then use an additional Redirect in the domain .cfg
file to point to user specific files if needed?

Adding the folders/subfolders looks like it would work nicely, but, I
have two concerns... 1)Folder/File structure under /Declude would
cause performance issues. Does anyone have experience with
putting that kind of folder/file structure with 100's of folders off
the /Declude node and 1,000s of file off the /domain node? 2) How well does the folder
structure system work with Store and Forward domains? 3) When Declude
uses "WHITELIST FROM" does it use the "from" in the email message or
the envelope sender?

I'm trying to compare these two options but don't have enough info.
Hoping someone can help me here.

Secondly, I'm looking at just
using an external test.  Based on what I'm reading, I could use
external-plus, BUT... I would need Declude to pass the envelope
sender, I see %SENDERHOST% but don't see sender anywhere, is this a
possibility?  Also, what happens if a user is bcc'd on a message? Will
that address show up in the %ALLRECIPS% parameter?  And...would
settings in a per domain file override settings in a per user file?

Thanks for any help.  I'm really trying to understand how all these
variables work together.

-David




---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scan

RE: [Declude.JunkMail] Different Tests Failed for same mail?

2004-02-22 Thread Kornitz, David
Kami,

That's for the suggestion, but most of the mail I am filtering is for 
businesses accounts.  These accounts do not have Mailboxes on the Imail server and 
therefore this option does not work.   

What we are in the process of doing is writing a front-end for declude using 
asp and the Net framework.  One of the features we're looking to incorporate in the 
processing of held mail through the a web interface.

I may end up just writing a routine to phrase the Imail envelope files and 
redistribute the email based on that. I suspect that one of the problems that Scott is 
running into is a message can be for multiple recipients and how do you put the 
message into multiple sub-folders.  My thought is to rewrite the envelope header such 
that each folder it is placed in only knows about it's email address.  An unfortunate 
side-effect of this concept is that the message is stored multiple times on the 
server.  

I'm going to check with a couple of other spam filtering services and see how 
they handle the processing of multiple recipients in the same messages with different 
rules and I post the information back to the list.

David

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Kami Razvan
Sent: Saturday, February 21, 2004 8:50 AM
To: [EMAIL PROTECTED]
Subject: RE: [Declude.JunkMail] Different Tests Failed for same mail?


 "  On another topic, but somewhat related, we are looking for a way to
move messages that are held to specific folders.  Under an ideal
circumstances I would like to see the messages moved to a folder like
"domain\email addresses\"  Does something like this exist or could it be
given future consideration?"

David..

We do this by using the mailbox action.

WEIGHT20m   MAILBOX spam

This has helped a lot- since we now send messages between 20-50 to spam
folder and delete on 50.

Users are given instructions on how to download the spam folder and use
rules to forward the email to that folder.  Or simply check it on the web.

Regards,
Kami

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


RE: [Declude.JunkMail] Different Tests Failed for same mail?

2004-02-21 Thread Kornitz, David
Scott,

Since each recipient can receive a different score how are the messages 
handled? 

1) What happens when a messages is whitelisted for one individual and blacklisted for 
another?   or you could also run into circumstances based on user preferences were one 
hit a hold value, one hits a delete and maybe other recipients allow the messages.  I 
know this is worst case, but I run across messages like this now.  Does the message 
get spilt into multiple messages (i.e. copies without all of the recipients at the 
envelope level)
2) With externalplus tests is there a new parameter to allow this test to see which 
email address is currently being tested?  (i.e. Recipient 1, Recipient 2, etc) 

On another topic, but somewhat related, we are looking for a way to move 
messages that are held to specific folders.  Under an ideal circumstances I would like 
to see the messages moved to a folder like "domain\email addresses\"  Does something 
like this exist or could it be given future consideration?

David

-Original Message-
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of R. Scott Perry
Sent: Friday, February 20, 2004 10:59 AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Different Tests Failed for same mail?



>here a Declude log, version 1.78.  Notice how it ends up with two 
>different "tests failed" lines?

Correct.  There is one for each recipient.

>The second one lists much FEWER tests - but the same weight?

Correct.  That's because only tests that have an action greater than LOG or 
have a weight assigned to them are listed.

>The second one also lists every action as "IGNORE" - while the first one 
>lists "WARN", "DELETE" and other actions.

Correct.  That's because the different recipients have different settings.

-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers 
since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver 
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.


[Declude.JunkMail] Legitimate AOL Messages being tagged as spam

2003-12-09 Thread Kornitz, David
I've been watching email go thru the system and all messages from AOL.COM are being 
tagged as spam.  The following tests for each email are failed: BADSENDERS:5 NOABUSE:2 
NOPOSTMASTER:1 nNON_ENGLISH:3 .  Total weight = 11.Does anyone else have this 
problem?  or have a suggestion as possible correction?

David
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.